INFORMATION TECHNOLOGY (IT) infrastructure security policies are represented in many types of policy documents, depending on the organization’s network and infrastructure needs. For example, a national telecommunications company’s network policies will look different from those of a regional retailer. These differences stem from different cybersecurity risks. They also present organizations with different choices to define and make in their security policies.

However, as much as organizations differ in size and mission, all networks must provide layers of security—from the perimeter through the network layers to, ultimately, the data being accessed. Information security professionals must understand well these common IT infrastructure needs and policies. If you do understand these foundational policy concepts and focus areas, you’ll be able to navigate infrastructure policy documents, regardless of how they are organized.

The key purpose of infrastructure security policies is to provide technical knowledge of:

• The interaction among various layers of the network
• The placement of key controls
• The types of risks that will be detected and guarded against

It’s important to understand the interactions of these infrastructure layers. The interactions of network layers provide an end-to-end view of infrastructure security. This understanding ensures that the impact of changes to the infrastructure will be well understood and well coordinated. This includes coordination of changes. For example, policies ensure that network and database administrators coordinate activities when a new database server is added to the network. The technical aspect ensures that devices collectively protect data as it flows from one device to another.

Additionally, infrastructure policies ensure that remote access, network, and authentication policies act collectively. Taking this end-to-end view ensures that controls are in place to protect data at rest (in storage) as well as data in transit—as when data passing from an employee’s home is encrypted through a virtual private network firewall and securely routed to an internal database server at the organization’s headquarters or at some other data center.

This chapter discusses common IT infrastructure policies. It’s not possible in one chapter, or even in one book, to cover all the possible security policies an organization needs. So, this chapter illustrates key points by selectively discussing some policies in more detail. The intent is to create an understanding of an IT infrastructure policy’s basic structure. In addition, the chapter discusses the most common security policies that relate to different infrastructure domains.